On 05/06/2010 02:51 PM, Petter Reinholdtsen wrote:
[Jeff Schroeder]
> What version of sssd do you have and could you please post your
> configuration file? There was an issue with 1.0.5 and certain
> configurations that would cause 100% cpu usage.
I'm using 1.0.5, yes. It is the version in Ubuntu/Lucid at the
moment. This is the config file I used:
[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains = UIO.NO
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
[pam]
reconnection_retries = 3
[domain/UIO.NO]
auth_provider = ldap
id_provider = ldap
ldap_uri = ldap://ldap.uio.no
ldap_search_base = cn=system,dc=uio,dc=no
ldap_tls_reqcert = demand
ldap_tls_cacertdir = /etc/ssl/certs
cache_credentials = true
enumerate = true
I suspect the problem might be the use of /etc/ssl/certs/ as the
cacertdir, as that problem with 100% CPU went away when I started
specifying "ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt".
I very much doubt this was the cause. It's more likely to have been
related to the cleanup code bug, and when you restarted the service it
bumped itself back into a usable state.
But I am still unable to get sssd to work properly with our LDAP
server. Suspect some certificate issue, but have not been able to
pinpoint the problem yet.
Make sure that the CA certificate has had cacert_rehash run on it, or
the openldap libraries won't be able to use it.
I've started working on a 1.1.1 package for Debian (and probably
into
Ubuntu too), but the package structure changed quite a bit and this
need more work before it can be uploaded into Debian. The 1.0.5
package is already uploaded into Debian, and just need to be accepted
into the archive to be available for testing.
Happy hacking,
If you're going to be building a new package with the newer structure,
I'd advise waiting a week. We're going to be releasing SSSD 1.1.91
imminently, with a week or two of translations and work with the various
OS maintainers to build packages. So it might be most efficient for you
to drop in and work with us during this period, and then you can get the
latest-and-greatest built.
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/